Tampered Claude Code Extension in Cursor: Up to 5,000 Users Hit, Check for the svc-telemetry SSH Key Today

On 29 October 2026, the Cursor extension marketplace served tampered builds 2.1.312 and 2.1.313 of the ClaudeClaude ProThe paid subscription for the Claude AI assistant from Anthropic. It unlocks connectors to outside tools.Open the glossary Code extension for 11 hours 8 minutes. If a Windows or macOS laptop on your team uses Cursor, search for the svc-telemetry SSH key now, then clean the laptop and rotate credentials if the key is there.

Cursor says at most 5,000 users were affected, in a Cursor post on X on 30 October 2026. Anthropic did not build the tampered version, according to the Cursor security notice.

A supply chain attack is an attack that enters through a tool or package you trust, not through a flaw in your own application. Here, that tool is an editor extension that developers use every day.

What happened on 29 October 2026?

An attacker published a modified copy of the Claude Code extension in the Cursor extension marketplace for 11 hours 8 minutes. The fake builds were live from 02:27 to 13:35 Pacific Time (PT), or 16:27 WIB on 29 October to 03:35 WIB on 30 October.

Cursor pulled the builds, closed the marketplace for a time, audited access, and rotated keys. Then Cursor rebuilt the marketplace and found no other modified extensions.

Item	Fact	Source
Extension	anthropic.claude-code builds 2.1.312 and 2.1.313	Cursor, 29 Oct 2026, updated 30 Oct
Platforms	Windows and macOS	Cursor
Window	16:27 WIB on 29 Oct to 03:35 WIB on 30 Oct, 11 h 8 min	Cursor
Affected users	At most 5,000	Cursor on X, 30 Oct 2026
Found by	Phorion, a macOS security company	Phorion, 30 Oct 2026
Attacker server	Offline	Cursor

Anthropic says its systems were not breached. Felix Rieseberg of Anthropic wrote on X on 30 October 2026 that the attacker used access to the Cursor marketplace, and that builds on official Anthropic channels are not affected. The Rieseberg post does not explain how the attacker got that access.

Who is affected, and who is not?

You are affected if Cursor on a Windows or macOS laptop installed Claude Code extension 2.1.312 or 2.1.313 during that 11-hour window. Automatic extension updates can install that build without a click from you.

Check every laptop that opened Cursor on 29 or 30 October 2026. This table gives the status of each channel.

Channel	Status	Source
Cursor marketplace, builds 2.1.312 and 2.1.313, Windows and macOS	Affected	Cursor
Other extensions in the Cursor marketplace	No changes found	Cursor
Official Anthropic channels, including the Claude Code CLI	Not affected	Anthropic, 30 Oct 2026
Open VSX	No evidence of impact. Phorion corrected its first finding to the Cursor marketplace.	Phorion, 30 Oct 2026

Cursor names only Windows and macOS builds. Phorion found a Linux persistence path in the same code. Linux users should still run the checks below.

What did the malicious code do?

The malicious code ran when Cursor loaded the extension, with no click, and then tried to open remote SSH access to the laptop. This summary comes from the Cursor notice and the Phorion advisory:

• It sent laptop data: host name, user name, operating system, work folders, Git email, public IP, and the names of environment variables that match KEY, TOKEN, SECRET, PASS, AWS, or GCP. The variable values were not sent.
• It added an attacker SSH key with the comment svc-telemetry to the authorized_keys file.
• It tried to start the SSH service and open an outbound SSH tunnel to the attacker server. A script tried again every 60 seconds.
• It installed persistence: the LaunchAgent com.apple.sysmond on macOS, the scheduled task SysMon on Windows, and an @reboot cron entry on Linux.

On macOS without admin rights, the step that turns on Remote Login often failed, according to Phorion. The SSH key and the persistence stayed in place. If Remote Login is on now or is turned on later, that access opens.

Cursor says the attacker server is offline. Clean the laptop anyway, because removing the extension does not remove the persistence scripts.

How do you check your laptop?

Search for the svc-telemetry key first, because that key is the strongest sign that the malicious code ran on your laptop. Run these commands in Terminal on macOS or Linux. The commands only read files and change nothing.

# 1. The attacker's SSH key
grep -n "svc-telemetry" ~/.ssh/authorized_keys

# 2. Persistence files
ls -la ~/.config/.smt ~/.config/.smtk ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null

# 3. Tunnel processes that still run
ps aux | grep -E "[s]sh -N -R|[a]utossh"

# 4. Cron entry (Linux)
crontab -l 2>/dev/null | grep -n "\.smt"

# 5. Claude Code extension folder in Cursor
ls ~/.cursor/extensions | grep -i "anthropic.claude-code"

On Windows, run these commands in PowerShell:

Select-String -Path "$HOME\.ssh\authorized_keys","C:\ProgramData\ssh\administrators_authorized_keys" -Pattern "svc-telemetry" -ErrorAction SilentlyContinue
schtasks /query /tn SysMon
Get-ChildItem "$HOME\.cursor\extensions" | Where-Object Name -like "anthropic.claude-code-*"

A clean laptop shows no output for commands 1 to 4. On Windows, a clean laptop only shows a message that the SysMon task does not exist.

Command 5 shows only the build that is installed now. A 2.1.312 or 2.1.313 folder is a strong sign, but a folder with another build does not prove the laptop is clean.

Sign	Location	OS
Key with the comment svc-telemetry	~/.ssh/authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys	All
Script .smt and key .smtk	~/.config/	macOS, Linux
LaunchAgent com.apple.sysmond	~/Library/LaunchAgents/	macOS
Scheduled task SysMon	Task Scheduler, also the Startup folder	Windows
Temporary key files .stk_*	/tmp/	macOS, Linux
Connections to 134.209.82[.]225	Firewall logs, port 22 or 8099	All

The full list of VSIX hashes and the extension.js hash is in the Cursor notice. Use that list if your team has EDR or endpoint logs.

What do you do if you find a sign?

Take the laptop off the network, run the Cursor clean-up script, and then rotate every key that laptop can read from another device. Follow this order:

1. Disconnect the Wi-Fi and the network cable of that laptop.
2. Download the clean-up script from the Cursor notice. Run remediate-macos.sh as the affected user, or remediate-windows.ps1 from an admin PowerShell.
3. Check the exit code of the script. A non-zero code means something remains.
4. Check SSH logs for logins from 127.0.0.1 or ::1 with the svc-telemetry key. Such a login shows that the attacker used the tunnel, according to Phorion.
5. Rotate credentials from another clean device. Follow the order in the next table.
6. Rebuild the system if the logs show an attacker login.

Order	What to rotate	Reason
1	SSH keys and Git tokens: GitHub, GitLab, Bitbucket	The SSH tunnel gives access to the user account on the laptop.
2	Cloud keys and deploy tokens: AWS, GCP, Cloudflare	The malicious code recorded variable names that match AWS and GCP.
3	APIAPIThe official door 2 systems use to exchange data, without anybody copying it by hand.Open the glossary keys in .env files: AI models, payments, email	The KEY, TOKEN, SECRET, and PASS patterns were recorded.
4	CLI and browser login sessions	An active session can be used from that laptop.

The variable names alone give the attacker a map of your services. If you find the svc-telemetry key, treat every key that the laptop can read as leaked.

What does this mean for team cost and work?

The largest cost of this incident is key rotation, because 1 developer laptop often holds access to Git, cloud, AI models, and payments. The attack window was only 11 hours 8 minutes, so a laptop that held extension updates for 24 hours did not receive this fake build.

Change these 5 things this week:

1. Turn off automatic extension updates on laptops that hold production access. In Cursor and VS Code, set "extensions.autoUpdate": false, then update by hand after a new build is 24 hours old.
2. Write a list of the extensions that your team may install. Remove extensions that nobody uses.
3. Move secrets out of shell environment variables into a secret manager or an encrypted file. Use short-lived tokens for cloud and Git.
4. Turn off Remote Login on macOS if your team does not use it. Check it in System Settings, General, Sharing, with an admin account.
5. Watch for changes to ~/.ssh/authorized_keys. A new line with no reason is an alarm.

Coding agents such as Claude Code make a team faster, but extensions and agents run with the rights of the user. Also read about the Claude Code 2.1.309 sandbox fix and the Claude Code 2.1.316 changes for other limits on agentAI agentAn AI program that performs work steps by itself, for example reading a message, drafting a reply, and recording the result.Open the glossary access.

Questions and answers

Is the Claude Code CLI affected?

No, according to Anthropic. Felix Rieseberg of Anthropic wrote on 30 October 2026 that builds on official Anthropic channels are not affected. This incident concerns only the extension copy in the Cursor marketplace.

Is it enough to remove the extension?

No. Cursor and Phorion say the persistence scripts keep running after you remove the extension. Search for the svc-telemetry key, run the Cursor clean-up script, and rotate credentials if you find a sign.

The attacker server is offline. Do I still need to rotate keys?

Yes, if you find a sign. That server was active during the attack window, so the laptop data may already be sent. Cursor still advises a clean-up and credential rotation from a clean device.

I use Linux. Is my laptop safe?

Cursor names only Windows and macOS builds. Phorion found an @reboot cron entry for Linux in the same code. Run the check commands above, because the commands only read files.

How can a small team prevent a similar case?

Hold extension updates for 24 hours on laptops with production access, limit the extension list, and keep secrets out of the shell environment. The window of this incident was 11 hours 8 minutes, so a 24-hour hold passed it.

Next steps

Run the 5 check commands today on every laptop that opened Cursor on 29 or 30 October 2026. If a sign shows, follow the clean-up and key rotation order before the laptop goes back on the office network.

If your team needs a code and infrastructure review after an incident, see the Vibe Code Rescue forensic audit.